@visa/cli 4.1.0-rc.193 → 4.1.0-rc.195

package/dist/skills/pair-visa-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pair-visa-agent
-description: Pair a Visa CLI v4 agent identity to this runtime. Sign the owner in first (agent_login), then present one authorization link, the returned public confirmation code, and the full public request-key fingerprint to the human, then poll until the runtime's local Ed25519 identity is activated. Use when the user says "pair my agent", "enroll my Visa CLI", "connect my Visa agent", or "set up my agent identity".
+description: Pair a Visa CLI v4 agent identity to this runtime. Present one authorization link, the returned public confirmation code, and the full public request-key fingerprint to the human (or claim a Console handoff code directly without local owner login), then poll until the runtime's local Ed25519 identity is activated. Use when the user says "pair my agent", "enroll my Visa CLI", "connect my Visa agent", or "set up my agent identity".
 compatibility: Needs the `visa` CLI (`npm i -g @visa/cli@rc`) — run `node scripts/setup.mjs` to install it if missing — plus network access to the Visa authorization service. Works in OpenClaw, Hermes, or any Agent Skills runtime.
 allowed-tools: Bash(visa:*) Bash(visa-cli:*) Bash(node:*) Bash(npm:*) Bash(npx:*)
 metadata:
@@ -101,7 +101,7 @@ OpenClaw users also receive the skill with the `@visa/visa-cli-openclaw` plugin.
      in `~/.hermes/config.yaml`.
    - **No MCP integration:** use the raw `visa agent …` commands.
 3. **Sign the owner in.** Pairing starts are owner-bound — see "Sign in first" below. On a
-   fresh runtime this step is required before any pairing command will succeed.
+   fresh runtime using direct pairing, this step is required before any pairing command will succeed. When claiming a Console handoff code, skip sign-in and claim the handoff directly.
 4. **Pair.** Follow the core flow below.
 
 ## MCP mounting examples
@@ -179,7 +179,8 @@ simply omits it, which is not an error. The activation result includes protocol
 Pairing starts are authenticated as the owner: the service pins the owner account at
 initiation, and the browser review page rejects any other signed-in account
 (`owner_profile_mismatch`). So on a fresh runtime the ceremony has a mandatory first leg —
-establish the owner session **before** any pairing command:
+establish the owner session **before** any runtime-initiated pairing command (Console handoff codes
+are owner-pinned by the code itself and do NOT require an active owner session):
 
 - [ ] Call `agent_login` (MCP, default action `"start"`) or run
       `visa agent login --format json` (CLI). The result carries a sign-in `browserUrl`
@@ -285,18 +286,19 @@ approve — you poll to completion yourself:
       later returns `{"code":"session_required"}`, the session lapsed — run `agent_login`
       again.
 - [ ] **Initiate the grant from MCP — no shelling, no invented URLs.** Call `agent_connect`
-      with the rail and caps: `{"rail":"card","ceiling":"<usd>","perTransaction":"<usd>"}`
-      (or `"rail":"wallet"`); omit `agentId` to target the most recently paired agent. It
-      returns `{ url, code, attachId, willGrant, expiresAt }`. Present the **bare `url` and
-      `code` exactly as returned** — never construct, shorten, or guess a Visa URL, and never
-      open it yourself. The crypto approval happens in the owner's browser and cannot run
+      with the rail, caps, and exact `agentId` returned by pairing:
+      `{"agentId":"<agentId>","rail":"card","ceiling":"<usd>","perTransaction":"<usd>"}`
+      (or `"rail":"wallet"`; `agentId` is optional only when exactly one eligible paired agent
+      exists on this runtime). It returns `{ url, code, attachId, willGrant, expiresAt }`. Present the
+      **bare `url` and `code` exactly as returned** — never construct, shorten, or guess a Visa URL, and
+      never open it yourself. The crypto approval happens in the owner's browser and cannot run
       inline in chat. (`setup_agent {"rail":"card"|"wallet"}` returns the same next-step map
       if you need it.)
 - [ ] **Owner approves once** on the **v4 agent dashboard** (`app.visacli.sh/agent/enroll`),
       confirming the caps — **card with a passkey, wallet with their sign-in session**. You
       cannot approve on their behalf.
 - [ ] **Poll to activation from MCP.** Call `agent_connect_poll` (`{"attachId":"<from
-    agent_connect>"}`; or resume by `agentId`) — one bounded poll per call. It returns
+agent_connect>"}`; or resume by `agentId`) — one bounded poll per call. It returns
       `{"ok":false,"state":"...","blockedByKind":"awaiting_human_approval"}` while pending;
       call again until `{"ok":true,"state":"grant_activated","caps":...}` (wallet also
       returns `fundAddress`). Activation registers the delegated signer + caps: wallet writes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visa/cli",
-  "version": "4.1.0-rc.193",
+  "version": "4.1.0-rc.195",
   "description": "Visa CLI runtime for stable agent identity and separately authorized payment capabilities",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "4.1.0-rc.193",
+  "version": "4.1.0-rc.195",
   "title": "Visa CLI",
   "description": "Pair a human-approved agent identity, configure payment capabilities separately, and discover and pay x402 services from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
@@ -9,7 +9,7 @@
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "4.1.0-rc.193",
+      "version": "4.1.0-rc.195",
       "transport": {
         "type": "stdio"
       },